Abstract:As the precursor of cyber-attacks, the campaigns of scanning groups are able to reflect the attack target and attack trend to a great extent, which provide highly valuable threat intelligence for cyber defenders to understand the current cyber security situation. However, how to identify scanning groups in the context of limited information, especially in the absence of relevant threat intelligence, remains a challenging problem. In this paper, we utilize the honeynet as the unique data source to propose a scanning group identification system, Scanner-Hunter, which focuses on identifying scanning groups targeting ICS devices. To better characterize scanning patterns, a novel traffic representation scheme for scanning traffic is proposed, which is composed of a set of feature vectors to describe all the ICS request packets. On this basis, we propose a novel self-expanding multi-class classification (SEMCC) model and the IP prefix judgment, which are deliberately integrated to cope with sophisticated scanning groups. Take the Modbus protocol as an example, we implement a prototype of Scanner-Hunter, and use six years of real-world honeynet datasets to evaluate its performance. The experimental results illustrate its effectiveness and superior performance compared with some popular machine learning methods and existing SOTA scanning group identification methods. In addition, Scanner-Hunter is further leveraged to investigate the group distribution and maliciousness of 506 unknown scanners, and some suspicious attack groups with APT characteristics are analyzed. Furthermore, accurate scanning group information will contribute to revealing potential attack organizations and supporting decision making to prevent or interrupt cyber-attacks in time.

Research of Analysis and Detection of Scanning Attack of NIDS

Port Scanning Techniques and Analysis of Attack and Defense

Use of host's software information to mitigate false positive in signature-based NIDS

Intrusion Detection And Simulation For High-Speed Networks

Research and Development of Worm Detection Technologies

Self-adaptive distributed detection method of port scan

Analysis,Improvement and Redevelopment of the snort

Study and Implementation of a Net-based Intrusion Detection System

Effectiveness Evaluation of a Scan Detection Platform

Research and Design of Intrusion Detection Systems Based on SNMP

Research about technology of port scan and port scan detect

Port Scan Detection Algorithms Based on Statistical Traffic Features

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

Research and implementation on snort-based hybrid intrusion detection system

On Modeling and Deploying an Effective Scan Monitoring System

Scanner-Hunter: An Effective ICS Scanning Group Identification System

A cyber-physical model for SCADA system and its intrusion detection

ACTIDS: An Active Strategy For Detecting And Localizing Network Attacks

New Trend of Intrusion Detection System for High-speed Networks

Port Scan Behavior Diagnosis by Clustering

A Honeypot-Based Degree Statistics Method for Scans Detection